Accumulo
  1. Accumulo
  2. ACCUMULO-918

Support secondary ColumnVisibility filtering

    Details

      Description

      To some degree, users have the ability to choose what to see during a scan, by providing a subset of their own authorizations at scan time. However, even this only gives the user the ability to filter using a disjunction of all elements in that subset (in other words, if it matches any of their authorizations). Users are not able to request data that matches a conjunction of the elements in their set of authorizations (or the subset requested at scan time).

      Example:
      User has auths: a,b
      User can see entries labeled with any of the following:

      a
      a|b
      

      If the user desired to only view entries that matched the disjunction, a|b, and not a only, then this is not currently possible. The reason this isn't possible is because the design of the VisibilityFilter is to prevent users from getting access to data they are not allowed to see. It does nothing to constrain the data to only what they want to see.

      This can be done on the client side, but it can also be achieved with a secondary filter applied later in the iterator stack, so that the undesirable data doesn't get sent back over the network in the first place.

      Consider the same situation, but the user wants to match entries that are visible by a AND visible by b.
      After the system iterator is applied, the user can see:

      a
      a|b
      

      After the second iterator is applied, with the authorizations b specified, the user can see only:
      a|b
      

      As a system iterator, the current VisibilityFilter cannot be used by users, as it doesn't properly get initialized with init(), and is constructed using an alternate constructor on the tserver. So, the VisibilityFilter needs to be changed to support being used by users in the iterator stack, or another filter needs to provide similar functionality for users.

        Activity

        Hide
        Keith Turner added a comment -

        Making some form of the VisibilityFilter available to user will help drop data w/ an incorrect visibility label at compaction time.

        Show
        Keith Turner added a comment - Making some form of the VisibilityFilter available to user will help drop data w/ an incorrect visibility label at compaction time.
        Hide
        Hudson added a comment -

        Integrated in Accumulo-Trunk-Hadoop-2.0 #46 (See https://builds.apache.org/job/Accumulo-Trunk-Hadoop-2.0/46/)
        ACCUMULO-918 Added user iterator for visibilities. TODO: add a test. (Revision 1440118)

        Result = SUCCESS
        ctubbsii :
        Files :

        • /accumulo/trunk/core/src/main/java/org/apache/accumulo/core/iterators/system/VisibilityFilter.java
        • /accumulo/trunk/core/src/main/java/org/apache/accumulo/core/iterators/user/VisibilityFilter.java
        Show
        Hudson added a comment - Integrated in Accumulo-Trunk-Hadoop-2.0 #46 (See https://builds.apache.org/job/Accumulo-Trunk-Hadoop-2.0/46/ ) ACCUMULO-918 Added user iterator for visibilities. TODO: add a test. (Revision 1440118) Result = SUCCESS ctubbsii : Files : /accumulo/trunk/core/src/main/java/org/apache/accumulo/core/iterators/system/VisibilityFilter.java /accumulo/trunk/core/src/main/java/org/apache/accumulo/core/iterators/user/VisibilityFilter.java
        Hide
        Hudson added a comment -

        Integrated in Accumulo-Trunk #688 (See https://builds.apache.org/job/Accumulo-Trunk/688/)
        ACCUMULO-918 Added user iterator for visibilities. TODO: add a test. (Revision 1440118)

        Result = SUCCESS
        ctubbsii :
        Files :

        • /accumulo/trunk/core/src/main/java/org/apache/accumulo/core/iterators/system/VisibilityFilter.java
        • /accumulo/trunk/core/src/main/java/org/apache/accumulo/core/iterators/user/VisibilityFilter.java
        Show
        Hudson added a comment - Integrated in Accumulo-Trunk #688 (See https://builds.apache.org/job/Accumulo-Trunk/688/ ) ACCUMULO-918 Added user iterator for visibilities. TODO: add a test. (Revision 1440118) Result = SUCCESS ctubbsii : Files : /accumulo/trunk/core/src/main/java/org/apache/accumulo/core/iterators/system/VisibilityFilter.java /accumulo/trunk/core/src/main/java/org/apache/accumulo/core/iterators/user/VisibilityFilter.java
        Hide
        Hudson added a comment -

        Integrated in Accumulo-Trunk #691 (See https://builds.apache.org/job/Accumulo-Trunk/691/)
        ACCUMULO-918 Added unit tests and fixed a few discovered bugs in user visibility filter (specifically, made the invalid label check use the cache, and fixed
        empty authorizations problem). (Revision 1440627)

        Result = SUCCESS
        ctubbsii :
        Files :

        • /accumulo/trunk/core/src/main/java/org/apache/accumulo/core/iterators/user/VisibilityFilter.java
        • /accumulo/trunk/core/src/test/java/org/apache/accumulo/core/iterators/user/VisibilityFilterTest.java
        Show
        Hudson added a comment - Integrated in Accumulo-Trunk #691 (See https://builds.apache.org/job/Accumulo-Trunk/691/ ) ACCUMULO-918 Added unit tests and fixed a few discovered bugs in user visibility filter (specifically, made the invalid label check use the cache, and fixed empty authorizations problem). (Revision 1440627) Result = SUCCESS ctubbsii : Files : /accumulo/trunk/core/src/main/java/org/apache/accumulo/core/iterators/user/VisibilityFilter.java /accumulo/trunk/core/src/test/java/org/apache/accumulo/core/iterators/user/VisibilityFilterTest.java
        Hide
        Hudson added a comment -

        Integrated in Accumulo-Trunk-Hadoop-2.0 #49 (See https://builds.apache.org/job/Accumulo-Trunk-Hadoop-2.0/49/)
        ACCUMULO-918 Added unit tests and fixed a few discovered bugs in user visibility filter (specifically, made the invalid label check use the cache, and fixed
        empty authorizations problem). (Revision 1440627)

        Result = SUCCESS
        ctubbsii :
        Files :

        • /accumulo/trunk/core/src/main/java/org/apache/accumulo/core/iterators/user/VisibilityFilter.java
        • /accumulo/trunk/core/src/test/java/org/apache/accumulo/core/iterators/user/VisibilityFilterTest.java
        Show
        Hudson added a comment - Integrated in Accumulo-Trunk-Hadoop-2.0 #49 (See https://builds.apache.org/job/Accumulo-Trunk-Hadoop-2.0/49/ ) ACCUMULO-918 Added unit tests and fixed a few discovered bugs in user visibility filter (specifically, made the invalid label check use the cache, and fixed empty authorizations problem). (Revision 1440627) Result = SUCCESS ctubbsii : Files : /accumulo/trunk/core/src/main/java/org/apache/accumulo/core/iterators/user/VisibilityFilter.java /accumulo/trunk/core/src/test/java/org/apache/accumulo/core/iterators/user/VisibilityFilterTest.java

          People

          • Assignee:
            Christopher Tubbs
            Reporter:
            Christopher Tubbs
          • Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Time Tracking

              Estimated:
              Original Estimate - 24h
              24h
              Remaining:
              Remaining Estimate - 24h
              24h
              Logged:
              Time Spent - Not Specified
              Not Specified

                Development